For the person who has to say yes
Security & data posture.
Short, straight answers. No hedging, no marketing language — this is the page to hand to whoever has to sign off on putting a box on the network.
- Can Spall write to my PLCs?
- No. Spall is read-only by contract — it polls tags and never issues a write. It recommends; your people act. There is no code path in the product that writes back to a controller.
- Does anything connect inbound to the plant?
- No. The edge gateway makes outbound-only connections — telemetry goes out over MQTT to the cloud. The gateway runs no remote-login service of any kind, not by default and not on request: there is nothing to enable, no standing tunnel, no shell. If support ever needs a hands-on look, it requires a small device physically connected to the gateway — nothing works over the network. No open ports on the gateway for the plant network to expose.
- Is our data locked into Spall?
- No. Data leaves through live Excel/OData feeds, direct SQL views, and a REST API — the same data your dashboards see, queryable on your terms. If you leave, you take your history with you.
- Can one tenant see another tenant’s data?
- No. Multi-tenant isolation is enforced at the API layer — every query is scoped by tenant, not left to client-side filtering. A super-admin role exists for box-wide operations but is separate from customer accounts.
- How are secrets handled?
- Secrets live in an env file (access-controlled, never committed or logged) by default, with an opt-in hardened layer using Docker secrets (file-based, mounted read-only) for anything that needs a higher bar. Diagnostics exports are redacted before they leave the box — no secret value, and no field whose name looks sensitive, is ever present in an export.
- What actually runs on the box?
- A local edge agent and a local data buffer. If the WAN drops, the agent keeps polling and buffering on-site, then backfills the cloud once connectivity returns — a plant floor outage doesn't lose history.
- What happens when the data is thin or missing?
- It says so. Missing data renders as “—”, never a fabricated number, and the AI abstains rather than guess when a signal doesn’t have enough history behind it. Honest gaps, not smoothed-over ones.
01
Read-only, always
02
Outbound-only networking
03
Your data, portable anytime
04
Secrets redacted on export